Pith. sign in

REVIEW 3 major objections 3 minor 56 references

Querying Kernel Methods Suffices for Reconstructing their Training Data

T0 review · 3 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proves that query-only access to a kernel model is enough to recover its exact training data, and demonstrates the attack on kernel regression, support vector machines, and kernel density estimation.

desk verdict The empirical query-only reconstruction attack is strong and the paper is worth engaging, but Theorem 2/6 is false as stated for d=1 via a Laplace-kernel counterexample; the theorem needs a dimension or full-support condition. read the letter →

arxiv 2505.19019 v1 pith:VE5WJOR7 submitted 2025-05-25 cs.LG

Daniel Barzilai , Yuval Margalit , Eitan Gronich , Gilad Yehudai , Meirav Galun , Ronen Basri This is my paper
classification cs.LG
keywords kernelmethodsdatareconstructionattackquery-onlyaccesstrainingprivacyridgeregressionsupportvectormachinesdensityestimation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a kernel model's training data can be recovered exactly by an attacker who only queries the model, i.e., observes its outputs on chosen inputs, without ever seeing the model parameters. For strictly positive definite, almost analytic kernels, the authors prove that with more than $n(d+2)$ queries drawn from a distribution with a density, every global minimizer of a least-squares reconstruction loss must reproduce the attacked function everywhere and must contain each original training point among its reconstructed points. They demonstrate the same attack on kernel ridge regression, support vector machines, and kernel density estimation, reconstructing recognizable images from CIFAR-10 and celebA models. The result matters because hiding model weights is often assumed to limit privacy risk; for kernel methods, query access alone can expose the underlying training data.

What carries the argument

The load-bearing object is the reconstruction loss, Eq. (4): $$L_{\mathrm{rec}}(P)=\frac{1}{mC}\sum_{j=1}^m\sum_{c=1}^C\left(\sum_{i=1}^n \hat{\$\alpha$}_{i,c} k(z_j,\hat{x}_i)-f_c(z_j)\right)^2,$$ which compares the attacked model's outputs with a candidate kernel expansion at $m$ unlabeled query points. The proof's engine is the Submersion Level Set Theorem, which shows that for $m>n(d+2)$ the set of query tuples for which some different predictor agrees with $f$ on every query is contained in a lower-dimensional submanifold of $X^m$, hence a null set under any distribution with a density. Strict positive definiteness supplies uniqueness of point-and-coefficient representations, while almost analyticity guarantees that a nonzero candidate cannot have all derivatives vanish at a point where it agrees with $f$, so each query contributes a nondegenerate constraint.

What would settle it

Take a low-dimensional Laplace-kernel regression model with known, distinct training points, set $n=N$, draw $m>n(d+2)$ query points from a continuous Gaussian distribution, and minimize Eq. (4) from many random initializations. If any run reaches a global minimum (loss numerically zero) yet its reconstructed points differ from the training points, the identifiability theorem is false; if no run reaches near-zero loss, the practical attack remains hostage to the uncharacterized loss landscape.

Watch

Extended reading notes

Core claim

The central discovery is an identifiability theorem (Theorem 2, restated as Theorem 6): fix an open input space $X\subseteq\mathbb{R}^d$, a strictly positive definite, almost analytic kernel $k$, and a predictor $f_c(x)=\sum_{i=1}^N \alpha_{i,c} k(x,x_i)$ whose training points $x_i$ are distinct and whose coefficients are not all zero. If an attacker samples $m>n(d+2)$ query points $z_j$ i.i.d. from any distribution with a density and minimizes the reconstruction loss over $n\ge N$ candidate points and coefficients, then with probability $1$ over the query sample every global minimizer satisfies $f_c(v)=\hat{f}_c(v)$ for all $v\in X$, and every training point $x_i$ appears among the reconstructed points $\hat{x}_j$ with matching aggregated coefficients. Strict positive definiteness makes the representation of the attacked function unique, and the almost analytic condition rules out spurious predictors that agree with $f$ on all queries without being identical to it.

Load-bearing premise

The theorem's guarantee is for global minimizers of a non-convex loss, and the paper does not show gradient descent reaches one; it also assumes the attacker knows the kernel and its hyperparameters.

Editorial extensions

If this is right

  • Any kernel predictor expressible as a weighted sum of kernel evaluations—kernel regression, SVMs, kernel density estimators, and gradient-trained models that stay in the span of the training features—is identifiable from its outputs alone.
  • The query count needed grows linearly in the number of training points and the input dimension, so scaling to larger models does not require exponentially many queries.
  • An attacker who overestimates the training set size recovers duplicate training points with aggregated coefficients plus zero-weight filler points, so the true training size need not be known in advance.
  • On natural-image benchmarks the query-only attack matches or beats reconstruction attacks that use model parameters, so parameter secrecy alone is not a sufficient defense.
  • With multi-output models, each query contributes additional equations, so the practical query requirement can drop toward roughly $n(d+C)/C$ when the output predictors are sufficiently different.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One testable extension is to target neural networks in the neural tangent kernel regime, where the trained function is approximately a fixed-kernel expansion; the identifiability argument suggests such networks may be equally exposed to query-only reconstruction.
  • Because the experiments use finite query pools while the theorem requires a continuous density, a natural conjecture is that identifiability survives under a rank or separation condition on the query kernel matrix, which would extend the guarantee to practical query sets.
  • Since the reconstruction loss needs no labels, an immediate next step is to scale the attack to millions of unlabeled queries and test defenses such as output perturbation, query limits, or differentially private training.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper studies privacy risks of kernel methods under query-only access. It proposes a reconstruction attack (Algorithm 1) that optimizes a reconstruction loss (Eq. 4) over surrogate training points and coefficients so that the resulting kernel expansion matches the queried evaluations of a target model. The main theoretical contribution is Theorem 2 (restated as Theorem 6), which claims that for strictly positive definite, almost analytic kernels, if the number of i.i.d. queries m from any distribution with a density exceeds n(d+2), then any global minimizer of the reconstruction loss equals the target function everywhere and recovers the exact training points. The paper also presents extensive experiments on CIFAR10/100 and celebA with kernel regression, SVMs, and KDE, reporting high-quality reconstructions and comparisons with prior white-box attacks.

Significance. If Theorem 2 were correct as stated, the paper would establish a strong and surprising privacy guarantee: exact training-set recovery from query-only access for a wide family of kernel methods, including models with infinite-dimensional feature maps. The proof strategy based on strict positive definiteness and a submersion-level-set parameter count is elegant, and the experimental study is extensive and reproducible (code is provided). However, the theorem is false as stated for d=1, and the experimental regime does not satisfy the theorem's assumptions. The empirical results remain valuable evidence for the practical attack, but the paper's central theoretical promise is currently overstated and requires substantial repair.

major comments (3)
  1. [Appendix B.2, definition of r(v,z) after Eq. (8)] Theorem 6 is false as stated for d=1. Take X=R, k(x,y)=e^{-γ|x-y|} (the Laplace kernel, one of the paper's main kernels), and f(x)=e^{-γ|x-2|}-e^{-γ}e^{-γ|x-1|}. For every x<1 one has f(x)=0, while f(3)≠0, so f is a valid attacked predictor with distinct centers and nonzero coefficients. Let D be uniform on (-1,0). Choose n=2, \hat x_1=0, \hat x_2=1/2, \hat α_1=1, \hat α_2=-e^{γ/2}. Then for every z<0, \hat f(z)=e^{γ z}-e^{γ/2}e^{-γ(1/2-z)}=0=f(z). Thus for every query tuple in (-1,0)^m the reconstruction loss (Eq. 4) is zero, and since the true representation also achieves zero loss, this \hat is a global minimizer. Yet neither reconstructed point equals the true points 1 or 2, contradicting the theorem's conclusion. The proof breaks exactly at the definition of r(v,z): the function g_f(v,·)=f-\hat f is analytic at each query (all centers are ≥0, queries are <0) and is not identically zero on all of R, but it is identically zero on the open set (-∞,0). Hence all partial derivatives of every order vanish at every query, so the finite vanishing order r is undefined. The sentence 'It holds that r is well-defined since g_f(v,·) is analytic at z and g_f(v,·)̸≡0' is false because the analyticity domain is disconnected in d=1, allowing the function to vanish on one component while being nonzero on another.
  2. [Theorem 2 / Theorem 6, scope of the probability-1 claim] The failure in d=1 is not an artifact of D having bounded support. For any absolutely continuous distribution with full support on R, the event that all m queries fall in (-∞,0) has positive probability. On that event the same spurious zero-loss global minimizer exists, so the set of query tuples for which the theorem's conclusion fails has positive measure, not measure zero. Consequently, the proof's central claim that the set Z of bad query tuples is Lebesgue null is false in d=1. To repair the theorem, the authors should either exclude d=1, or prove a lemma that for the claimed setting every non-identically-zero evaluation function has finite vanishing order at every non-violating query point. Such a lemma is plausible for d≥2 when each center contributes only countably many singular points, since the complement of a countable set is then connected and a real-analytic function vanishing on an open set vanishes on the whole component. The manuscript currently provides no such argument.
  3. [Section 7 and Appendix A.1, relationship between theory and experiments] The experimental setup does not operate in the regime covered by Theorem 2. For CIFAR10 with n=500 and d=3072, the theorem requires m>500·(3072+2)=1,537,000 queries, but the reported runs use m=500,000. Moreover, query points are sampled from a finite pool of natural images (e.g., CIFAR-5M), not from a distribution given by a density over the input space, as Theorem 2 requires. Section 8 also concedes that the loss landscape is not characterized, so gradient descent is not guaranteed to reach a global minimizer of Eq. (4). These gaps should be acknowledged explicitly in the main text; as written, the experiments provide empirical evidence for the attack but do not validate the theorem's quantitative or qualitative regime.
minor comments (3)
  1. [Definition 1] The notation 'C 1(X)' should be 'C^1(X)'.
  2. [Section 5, paragraph after Theorem 2] The theorem assumes the attacker knows the exact kernel and its hyperparameters; this is a strong assumption and should be stated in the main text, especially since Fig. D.3 shows reconstruction quality degrades substantially with a wrong choice of γ.
  3. [Appendix B.2, near the definition of Z_B] The notation 'n ′' and the phrase 'more than n of the queries are violating' are used before the formal definition; clarifying that n' is an integer with n<n'≤m would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the reconstruction loss is defined from fresh queries and does not contain the training points it is claimed to recover.

full rationale

The derivation is self-contained against the claim. Equation (4) defines L_rec using only sampled query points z_j and the attacked model's evaluations f_c(z_j); the true training points {x_i} and coefficients {alpha_i,c} do not appear as optimization inputs. The theorem's hypotheses—strict positive definiteness and almost analyticity—are kernel-class assumptions, and the proof shows via the Submersion Level Set Theorem that any predictor agreeing with f on a full-dimensional set of queries must agree everywhere, with Proposition 3 then converting equality of functions into equality of representations using invertibility of a strictly positive definite kernel matrix. None of these ingredients is defined in terms of the target reconstruction. The zero-loss global minimum is not assumed: when n >= N the true representation is feasible, so the minimum value is 0 by construction; this is a reachable baseline, not the conclusion imported as an input. Empirical choices such as kernel hyperparameters and query counts are not fitted to the training points being recovered, and the manuscript explicitly avoids overlap between the CIFAR-5M query pool and the training images. The self-citations in the related-work section and baselines (e.g., Barzilai et al. 2023, Haim et al. 2022) are not load-bearing for the main theorem. The limitation the paper itself flags—the uncharacterized loss landscape in Section 8—is a convergence concern about reaching global minima, not equation-level circularity; any d=1 edge case is likewise a correctness concern, not circular reasoning. No circular step is therefore identified.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on five premises: exact finite kernel representability with a known kernel, strict positive definiteness plus almost analyticity, a density-supported query distribution, attainment of a global zero-loss minimum, and knowledge of an upper bound on the training set size. The first two are standard and satisfied by the kernels used; the third and fourth are idealizations that separate the theorem from the experiments; the fifth is a threat-model assumption. There are no invented physical or mathematical entities and no free parameters fitted to the ground-truth training data.

free parameters (3)
  • Kernel hyperparameters (gamma, degree, NTK depth) = Laplace 0.15 (32px), 0.03 (64px, 128px); RBF 0.003 (32px), 0.0005 (64px), 0.0001 (128px); cubic c0=1, gamma=0.001; NTK…
    Chosen by hand per dataset and resolution. Reconstruction quality depends on gamma, with Fig. D.3 showing a U-shape, so these choices are load-bearing for the empirical results, although they are not fit to the training data.
  • Reconstruction set size n = n = 500 in main runs; n in {300, 400, 600, 700} in Table 3
    The attack's success rate rises with n (Table 3 shows 83% at n=300 up to 96.6% at n=700), so n is a hand-chosen parameter of the attack whose value materially affects the reported reconstruction quality.
  • Number of query points m = 500,000 (CIFAR10), 200,000 (CIFAR100), 162,770 (celebA)
    m is chosen by the attacker; the proven C=1 bound requires m > n(d+2), while the multi-class bound is heuristic, so the practical m is a tuning choice rather than a fully theory-specified quantity.
assumptions (5)
  • domain assumption The attacked model is exactly representable as a finite kernel expansion f_c(x) = sum_i alpha_{i,c} k(x, x_i) with the same known kernel k used by the attacker (Eq. 2).
    Invoked throughout Sec. 4 and required by Thm. 2. Holds for kernel ridge regression via the representer theorem, for SVM trained by gradient descent in the alpha parameterization, and for KDE, but not proven for arbitrary kernel training algorithms.
  • domain assumption The kernel k is strictly positive definite and almost analytic (Def. 1).
    Central condition of Thm. 2/6. The paper cites Carvalho et al. 2025 for NTK positivity and Sriperumbudur et al. 2011 for bounded translation-invariant kernels, covering the Laplace and RBF kernels used experimentally.
  • domain assumption The query distribution D has a density over the open set X, and queries are i.i.d.
    Thm. 2 requires D(E)=0 for every Lebesgue-null E. The practical queries are natural or synthetic images from a finite pool, which are concentrated on a low-dimensional image manifold, so the theorem's density condition is an idealization not satisfied by the experiments.
  • ad hoc to paper The reconstruction optimization attains a global minimum with zero loss.
    Thm. 2 applies to 'any solution to the minimization problem' (Eq. 4). The true training configuration is a zero-loss point, but no proof is given that gradient-based optimization reaches one; Section 8 explicitly identifies the loss landscape as uncharacterized.
  • domain assumption The attacker knows n >= N, an upper bound on the number of training points.
    Thm. 2 requires n >= N. Table 3 shows that with n < N the attack recovers only a fraction of the dataset, so this bound is load-bearing for the guarantee and for the best empirical results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Querying Kernel Methods Suffices for Reconstructing their Training Data." pith.science (2026). https://pith.science/paper/VE5WJOR7

@misc{pith2026250519019,
  author       = {Pith},
  title        = {Pith review of: Querying Kernel Methods Suffices for Reconstructing their Training Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VE5WJOR7}},
  note         = {Machine review of arXiv:2505.19019}
}
read the original abstract

Over-parameterized models have raised concerns about their potential to memorize training data, even when achieving strong generalization. The privacy implications of such memorization are generally unclear, particularly in scenarios where only model outputs are accessible. We study this question in the context of kernel methods, and demonstrate both empirically and theoretically that querying kernel models at various points suffices to reconstruct their training data, even without access to model parameters. Our results hold for a range of kernel methods, including kernel regression, support vector machines, and kernel density estimation. Our hope is that this work can illuminate potential privacy concerns for such models.

Figures

Figures reproduced from arXiv: 2505.19019 by the authors.

Figure 1
Figure 1. Black-box reconstruction of training images in a kernel regression task with an RBF kernel [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Reconstruction of training points from a two-dimensional kernel density estimator that [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Top reconstructions from multiple kernel models trained on CIFAR10 images. Bottom [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Reconstruction quality for different kernels and use cases on CIFAR10. Left: Comparison [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 30 canonical work pages

  1. [1]

    A convergence theory for deep learning via over-parameterization

    Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. A convergence theory for deep learning via over-parameterization. In International conference on machine learning, pages 242--252. PMLR, 2019

    2019

  2. [2]

    On exact computation with an infinitely wide neural net

    Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, Russ R Salakhutdinov, and Ruosong Wang. On exact computation with an infinitely wide neural net. Advances in neural information processing systems, 32, 2019

    work page 2019

  3. [3]

    Du, Zhiyuan Li, Ruslan Salakhutdinov, Ruosong Wang, and Dingli Yu

    Sanjeev Arora, Simon S. Du, Zhiyuan Li, Ruslan Salakhutdinov, Ruosong Wang, and Dingli Yu. Harnessing the power of infinitely wide deep nets on small-data tasks. In International Conference on Learning Representations, 2020. URL https://openreview.net/forum?id=rkl8sJBYvH

    work page 2020

  4. [4]

    Information complexity of stochastic convex optimization: Applications to generalization, memorization, and tracing

    Idan Attias, Gintare Karolina Dziugaite, Mahdi Haghifam, Roi Livni, and Daniel M Roy. Information complexity of stochastic convex optimization: Applications to generalization, memorization, and tracing. In Forty-first International Conference on Machine Learning, 2024

    work page 2024

  5. [5]

    Generalization in kernel regression under realistic assumptions

    Daniel Barzilai and Ohad Shamir. Generalization in kernel regression under realistic assumptions. In Forty-first International Conference on Machine Learning, 2024

    work page 2024

  6. [6]

    A kernel perspective of skip connections in convolutional networks

    Daniel Barzilai, Amnon Geifman, Meirav Galun, and Ronen Basri. A kernel perspective of skip connections in convolutional networks. In The Eleventh International Conference on Learning Representations, 2023

    work page 2023

  7. [7]

    Frequency bias in neural networks for input of non-uniform density

    Ronen Basri, Meirav Galun, Amnon Geifman, David Jacobs, Yoni Kasten, and Shira Kritchman. Frequency bias in neural networks for input of non-uniform density. In International conference on machine learning, pages 685--694. PMLR, 2020

    work page 2020

  8. [8]

    Reconciling modern machine-learning practice and the classical bias--variance trade-off

    Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. Reconciling modern machine-learning practice and the classical bias--variance trade-off. Proceedings of the National Academy of Sciences, 116 0 (32): 0 15849--15854, 2019

    work page 2019

Show all 56 references
  1. [9]

    Deep equals shallow for relu networks in kernel regimes

    Alberto Bietti and Francis Bach. Deep equals shallow for relu networks in kernel regimes. arXiv preprint arXiv:2009.14397, 2020

    2009 arXiv

  2. [10]

    On the inductive bias of neural tangent kernels

    Alberto Bietti and Julien Mairal. On the inductive bias of neural tangent kernels. Advances in Neural Information Processing Systems, 32, 2019

    2019

  3. [11]

    taesd: Tiny autoencoder for stable diffusion

    Ollin Boer Bohan. taesd: Tiny autoencoder for stable diffusion. https://github.com/madebyollin/taesd, 2023. Accessed: [25/01/25]

    2023

  4. [12]

    Gavin Brown, Mark Bun, Vitaly Feldman, Adam Smith, and Kunal Talwar. When is memorization of irrelevant training data necessary for high-accuracy learning? In Proceedings of the 53rd annual ACM SIGACT symposium on theory of computing, pages 123--132, 2021

    2021

  5. [13]

    Deconstructing data reconstruction: Multiclass, weight decay and general losses

    Gon Buzaglo, Niv Haim, Gilad Yehudai, Gal Vardi, Yakir Oz, Yaniv Nikankin, and Michal Irani. Deconstructing data reconstruction: Multiclass, weight decay and general losses. Advances in Neural Information Processing Systems, 36, 2024

    2024

  6. [14]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages...

    2021

  7. [15]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646, 2022

    2022 arXiv

  8. [16]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2023 a

    2023

  9. [17]

    Extracting training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253--5270, 2023 b

    2023

  10. [18]

    The positivity of the neural tangent kernel

    Lu \' s Carvalho, Jo \ a o L Costa, Jos \'e Mour \ a o, and Gon c alo Oliveira. The positivity of the neural tangent kernel. SIAM Journal on Mathematics of Data Science, 7 0 (2): 0 495--515, 2025

    2025

  11. [19]

    On lazy training in differentiable programming

    L\' e na\" c Chizat, Edouard Oyallon, and Francis Bach. On lazy training in differentiable programming. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d Alch\' e -Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Assoc...

    2019

  12. [20]

    On the algorithmic implementation of multiclass kernel-based vector machines

    Koby Crammer and Yoram Singer. On the algorithmic implementation of multiclass kernel-based vector machines. Journal of machine learning research, 2 0 (Dec): 0 265--292, 2001

    2001

  13. [21]

    A probabilistic theory of pattern recognition, volume 31

    Luc Devroye, L \'a szl \'o Gy \"o rfi, and G \'a bor Lugosi. A probabilistic theory of pattern recognition, volume 31. Springer Science & Business Media, 2013

    2013

  14. [22]

    Gradient descent finds global minima of deep neural networks

    Simon Du, Jason Lee, Haochuan Li, Liwei Wang, and Xiyu Zhai. Gradient descent finds global minima of deep neural networks. In International conference on machine learning, pages 1675--1685. PMLR, 2019

    2019

  15. [23]

    Scaling rectified flow transformers for high-resolution image synthesis

    Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas M \"u ller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Mach...

    2024

  16. [24]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322--1333, 2015

    2015

  17. [25]

    Reconstructing training data from trained neural networks

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks. Advances in Neural Information Processing Systems, 35: 0 22911--22924, 2022

    2022

  18. [26]

    Surprises in high-dimensional ridgeless least squares interpolation

    Trevor Hastie, Andrea Montanari, Saharon Rosset, and Ryan J Tibshirani. Surprises in high-dimensional ridgeless least squares interpolation. The Annals of Statistics, 50 0 (2): 0 949--986, 2022

    2022

  19. [27]

    Model inversion attacks against collaborative inference

    Zecheng He, Tianwei Zhang, and Ruby B Lee. Model inversion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 148--162, 2019

    2019

  20. [28]

    Neural tangent kernel: Convergence and generalization in neural networks

    Arthur Jacot, Franck Gabriel, and Cl \'e ment Hongler. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018

    2018

  21. [29]

    An introduction to statistical learning, volume 112

    Gareth James, Daniela Witten, Trevor Hastie, Robert Tibshirani, et al. An introduction to statistical learning, volume 112. Springer, 2013

    2013

  22. [30]

    Directional convergence and alignment in deep learning

    Ziwei Ji and Matus Telgarsky. Directional convergence and alignment in deep learning. Advances in Neural Information Processing Systems, 33: 0 17176--17186, 2020

    2020

  23. [31]

    Scaling laws for neural language models

    Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361, 2020

    2001 arXiv

  24. [32]

    Adam: A method for stochastic optimization

    Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014

    2014 arXiv

  25. [33]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  26. [34]

    Deep neural networks as gaussian processes

    Jaehoon Lee, Yasaman Bahri, Roman Novak, Samuel S Schoenholz, Jeffrey Pennington, and Jascha Sohl-Dickstein. Deep neural networks as gaussian processes. preprint arXiv:1711.00165, 2017

    2017 arXiv

  27. [35]

    Wide neural networks of any depth evolve as linear models under gradient descent

    Jaehoon Lee, Lechao Xiao, Samuel Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl-Dickstein, and Jeffrey Pennington. Wide neural networks of any depth evolve as linear models under gradient descent. Advances in neural information processing systems, 32, 2019

    2019

  28. [36]

    John M. Lee. Submanifolds. In John M. Lee, editor, Introduction to Smooth Manifolds, volume 218 of Graduate Texts in Mathematics, pages 105--106. Springer New York, New York, NY, 2 edition, 2012. ISBN 978-1-4419-9982-5. doi:10.1007/978-1-4419-9982-5. URL https://doi.org/10.100...

    2012 doi

  29. [37]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  30. [38]

    Understanding reconstruction attacks with the neural tangent kernel and dataset distillation

    Noel Loo, Ramin Hasani, Mathias Lechner, Alexander Amini, and Daniela Rus. Understanding reconstruction attacks with the neural tangent kernel and dataset distillation. arXiv preprint arXiv:2302.01428, 2023

    2023 arXiv

  31. [39]

    Gradient descent maximizes the margin of homogeneous neural networks

    Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin of homogeneous neural networks. arXiv preprint arXiv:1906.05890, 2019

    1906 arXiv

  32. [40]

    Generalization error of random feature and kernel methods: hypercontractivity and kernel matrix concentration

    Song Mei, Theodor Misiakiewicz, and Andrea Montanari. Generalization error of random feature and kernel methods: hypercontractivity and kernel matrix concentration. Applied and Computational Harmonic Analysis, 59: 0 3--84, 2022

    2022

  33. [41]

    On learning vector-valued functions

    Charles A Micchelli and Massimiliano Pontil. On learning vector-valued functions. Neural computation, 17 0 (1): 0 177--204, 2005

    2005

  34. [42]

    The deep bootstrap framework: Good online learners are good offline generalizers

    Preetum Nakkiran, Behnam Neyshabur, and Hanie Sedghi. The deep bootstrap framework: Good online learners are good offline generalizers. arXiv preprint arXiv:2010.08127, 2020

    2010 arXiv

  35. [43]

    Reconstructing training data from real world models trained with transfer learning

    Yakir Oz, Gilad Yehudai, Gal Vardi, Itai Antebi, Michal Irani, and Niv Haim. Reconstructing training data from real world models trained with transfer learning. arXiv preprint arXiv:2407.15845, 2024

    2024 arXiv

  36. [44]

    Random features for large-scale kernel machines

    Ali Rahimi and Benjamin Recht. Random features for large-scale kernel machines. Advances in neural information processing systems, 20, 2007

    2007

  37. [45]

    A generalized representer theorem

    Bernhard Sch \"o lkopf, Ralf Herbrich, and Alex J Smola. A generalized representer theorem. In International conference on computational learning theory, pages 416--426. Springer, 2001

    2001

  38. [46]

    Multivariate density estimation: theory, practice, and visualization

    David W Scott. Multivariate density estimation: theory, practice, and visualization. John Wiley & Sons, 2015

    2015

  39. [47]

    Super-convergence: Very fast training of neural networks using large learning rates

    Leslie N Smith and Nicholay Topin. Super-convergence: Very fast training of neural networks using large learning rates. In Artificial intelligence and machine learning for multi-domain operations applications, volume 11006, pages 369--386. SPIE, 2019

    2019

  40. [48]

    Provable privacy attacks on trained shallow neural networks

    Guy Smorodinsky, Gal Vardi, and Itay Safran. Provable privacy attacks on trained shallow neural networks. arXiv preprint arXiv:2410.07632, 2024

    2024 arXiv

  41. [49]

    Diffusion art or digital forgery? investigating data replication in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6048--6058, 2023

    2023

  42. [50]

    Universality, characteristic kernels and RKHS embedding of measures

    Bharath K Sriperumbudur, Kenji Fukumizu, and Gert RG Lanckriet. Universality, characteristic kernels and RKHS embedding of measures. Journal of Machine Learning Research, 12 0 (7), 2011

    2011

  43. [51]

    Benign overfitting in ridge regression

    Alexander Tsigler and Peter L Bartlett. Benign overfitting in ridge regression. J. Mach. Learn. Res., 24: 0 123--1, 2023

    2023

  44. [52]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13 0 (4): 0 600--612, 2004

    2004

  45. [53]

    Precise learning curves and higher-order scaling limits for dot product kernel regression

    Lechao Xiao and Jeffrey Pennington. Precise learning curves and higher-order scaling limits for dot product kernel regression. arXiv preprint arXiv:2205.14846, 2022

    2022 arXiv

  46. [54]

    Tensor programs iib: Architectural universality of neural tangent kernel training dynamics

    Greg Yang and Etai Littwin. Tensor programs iib: Architectural universality of neural tangent kernel training dynamics. In International Conference on Machine Learning, pages 11762--11772. PMLR, 2021

    2021

  47. [55]

    Neural network inversion in adversarial setting via background knowledge alignment

    Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. Neural network inversion in adversarial setting via background knowledge alignment. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 225--240, 2019

    2019

  48. [56]

    Understanding deep learning (still) requires rethinking generalization

    Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communications of the ACM, 64 0 (3): 0 107--115, 2021

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.